admin_client / admin_user fixtures are dependent on AUTHENTICATION_BACKEND order

I just upgraded to pytest-django 4.1.0 from 3.10.0 and a lot of my tests broke which rely on admin_client / admin_user.

It turns out that the code in https://github.com/pytest-dev/pytest-django/commit/79b7754669660543b593bdad471e73a9dabc04ed uses the first backend that has get_user, which may return None.

In my case I have base settings in a file settings_global.py and recommend to import that from the settings.py in production via:

from .settings_global import *  # noqa

and modify settings after that line.

settings_global.py contains:

AUTHENTICATION_BACKENDS = (
    'django.contrib.auth.backends.RemoteUserBackend',
    'guardian.backends.ObjectPermissionBackend',
)

Using RemoteUserBackend is recommended for production (using kerberos, AD, x509 client certs or whatever the apache authentication mechanism is deemed appropriate for the production site).

So for settings_test.py I have:

AUTHENTICATION_BACKENDS += (  # noqa
    'django.contrib.auth.backends.ModelBackend',  # this is default'
)

(Of course it's explicitly discouraged to use ModelBackend for production.

This results in RemoteUserBackend being used first for tests, which are supposed to use ModelBackend.

The test failures are caused by user being None, which the views automatically convert to the Guardian AnonymousUser instance, which of course has no permissions.

Of course the simple fix is:

AUTHENTICATION_BACKENDS = (  # noqa
    'django.contrib.auth.backends.ModelBackend',  # this is default'
) + AUTHENTICATION_BACKENDS  # noqa

So ModelBackend is used first for tests.

I'm not sure if that's intended, as the tests worked with 3.10.0.

At least I'd suggest that this should be documented.

Review commit 79b7754669660543b593bdad471e73a9dabc04ed and the admin_client/admin_user fixture path, focusing on how AUTHENTICATION_BACKENDS order selects get_user. Confirm the behavior against the reported RemoteUserBackend and ModelBackend configuration, then determine whether the intended outcome is a fixture change or documentation covering backend ordering.